                           callback-uri code (:state session))}}))))
       wrap-params)
 
-     ::exchange-code-for-access-token
+     ;; RFC 6749 4.1 (D) - and this is the Token endpoint as described
+     ;; in section 3 (Protocol Endpoints)
+     ::token-endpoint
      ;; This is initiated by the client
      (-> (fn [req]
            (let [params (:form-params req)
                  code (get params "code")
                  client-id (get params "client_id")
-                 client-secret (get params "client_secret")
                  client (lookup-client+ (:client-registry this) client-id)]
 
-             (if (not= (:client-secret client) client-secret)
-               {:status 400 :body "Invalid request - bad secret"}
+             ;; "When making the request, the client authenticates with
+             ;; the authorization server."
+             (if (not= (get params "client_secret") (:client-secret client))
+               {:status 403 :body "Client could not be authenticated"}
 
                (if-let [{identity :cylon/identity
                          granted-scopes :granted-scopes}

         wrap-params
         wrap-schema-validation)

     ::permit
     (->
      ;; TODO I'm worred about the fact we must ensure that the session

         wrap-params )})

  (routes [this]
    ["/" {"authorize" {:get ::authorization-endpoint}
          "permit-client" {:post ::permit}
          ;; TODO: Can we use a hyphen instead here?
          "access_token" {:post ::token-endpoint}}])

  (uri-context [this] "/login/oauth")

  AccessTokenAuthorizer
  (authorized? [component access-token scope]
    (if-not (contains? (set (keys scopes)) scope)
      (throw (ex-info "Scope is not a known scope to this authorization server"
                      {:component component
                       :scope scope
                       :scopes scopes}))
      (contains? (:scopes (get-session (:access-token-store component) access-token))
                 scope)))

  RequestAuthorizer
